Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5b0e8ea9-7fd3-4e74-87d7-c3b7e69d8a7b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5b0e8ea9-7fd3-4e74-87d7-c3b7e69d8a7b

The live entitlements-default demo proved edge.permission adds a public_repo scope requirement to an admin:org token. Read only the source-specific roles consumed by reconciliation, without broadening credentials or falling back to effective permissions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5b0e8ea9-7fd3-4e74-87d7-c3b7e69d8a7b

Remove all repository team associations and undeclared direct grants, including outside collaborators. Preserve team hierarchy and membership, order user upserts before cleanup, and verify snapshots before and after application.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a8107bce-2500-45f8-b046-3f50092d9fbd

Discover base permissions and every organization role and assignment. Accept owners as desired users, defer ambiguous owner grants and roles below inherited access, and preserve organization/enterprise team sources using access_source. Refresh organization access for stale-plan and convergence checks, fail closed on incomplete metadata, and document required read permissions and policy exceptions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a8107bce-2500-45f8-b046-3f50092d9fbd

… standards.

Memoize organization access for the repository backend, reuse preflight team state during removals, and avoid an unconditional post-apply snapshot. Remove the redundant local repository-name restriction while preserving typed boundaries and drift checks.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 292c069a-f691-4294-9c1e-a1a66e38e1d1

Replace repository collaborator GraphQL reads with REST direct-affiliation inventory, reuse the reconciled organization membership cache, and document effective-role semantics. Bump the plugin major version for the repository backend behavior change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 292c069a-f691-4294-9c1e-a1a66e38e1d1

Split configuration, planning, model normalization, and transport logic into focused helpers with idiomatic Ruby method names.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: fec518cc-2bda-47aa-970e-92a6f437f5ae

Match existing provider read, diff, and commit conventions and use the established sync naming for repository mutations.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: fec518cc-2bda-47aa-970e-92a6f437f5ae

Refresh shared membership before apply, honor organization base permissions, and return nil after invitation warnings. Add regression coverage and document the organization settings requirement.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 14f3aa9b-c498-4260-9ab0-398b14e31350